AI rules are coming to Canada: what a small business should actually watch (and what to ignore)
Canada has no AI-specific federal law yet — the Artificial Intelligence and Data Act died in January 2025 without passing. What actually applies to your business today is federal privacy law, an Ontario employment standards rule, and the EU AI Act if you have EU exposure. Here is the regulatory map.
Canada has no AI-specific federal law. The Artificial Intelligence and Data Act — the law that would have changed that — died on the order paper in January 2025 when Parliament was prorogued, and it was not revived. What actually binds a Canadian small business using AI today comes from three frameworks that already exist: federal privacy law under PIPEDA, an Ontario employment standards rule requiring disclosure of AI in hiring that took effect January 1, 2026, and — for any business with EU-facing operations — the EU AI Act, whose high-risk AI system requirements became active in August 2026. A new federal privacy bill (C-36) is before Parliament but has not passed. Here is the regulatory map as it stands, and what you can safely set aside.
The law that did not pass: what happened to AIDA
In June 2022, the federal government introduced Bill C-27, a package of digital legislation that included the Artificial Intelligence and Data Act (AIDA) — Canada's proposed first AI-specific law. AIDA would have imposed risk-based obligations on developers and deployers of "high-impact AI systems": mandatory impact assessments, risk-mitigation requirements, and a new AI and Data Commissioner role. The bill generated substantial business and policy attention for nearly three years. When Parliament was prorogued on January 6, 2025, the bill died without passing. The current government has not reintroduced it. Any vendor, consultant, or guide describing compliance requirements under a "Canadian AI Act" is referring to a bill that never became law.
What actually applies to your business right now
Three frameworks are active for Canadian small businesses using AI. First, PIPEDA — the federal Personal Information Protection and Electronic Documents Act — applies whenever you collect, use, or disclose personal information in connection with an AI tool, whether you built it or a third-party tool processes your customers' data. The Office of the Privacy Commissioner named AI enforcement a stated priority in its 2025-2026 annual report and has investigated major AI companies for PIPEDA violations including failure to obtain meaningful consent, inadequate data accuracy practices, and opaque privacy communications. Those expectations apply to businesses of all sizes. Second, the federal government released a Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems in September 2023 — it is not binding, but over 55 organizations had signed as of mid-2025, and it signals the direction binding rules will take. Third, if you have 25 or more employees and post publicly advertised jobs, Ontario's Working for Workers Four Act, 2024 requires a disclosure in the job posting if AI is used to screen, assess, or select applicants — a requirement in force since January 1, 2026.
If your operations touch the EU: the AI Act is already active
The EU AI Act entered into force on August 1, 2024 and applies extraterritorially — it captures Canadian companies that develop AI systems placed on the EU market, deploy AI affecting EU users, or provide AI models to EU operators. As of August 2, 2026, the Act's requirements for high-risk AI systems are active. High-risk categories include AI used in hiring and employment decisions, credit and insurance scoring, biometrics, and critical infrastructure. A Canadian SaaS company that uses AI to screen job applicants and serves EU-based clients is operating a high-risk AI system under the Act as of this date, which triggers documentation, human oversight, accuracy logging, and registration requirements. If your business has any EU customer, client, or partner exposure, assess whether your AI tools touch any of those categories.
Coming next: Bill C-36 and the new federal privacy regime
On June 15, 2026, the federal government tabled Bill C-36 — the Protecting Privacy and Consumer Data Act — a new attempt at replacing PIPEDA. This is the third attempt (Bills C-11 and C-27 both died in previous Parliaments). Unlike C-27, Bill C-36 does not include AI-specific provisions; it addresses privacy only. PIPEDA remains the law until C-36 receives Royal Assent, and the bill is at first reading as of September 2026. When and if it passes, the new regime will recognize privacy as a fundamental right and will impose substantially higher penalties compared to PIPEDA. The practical move now is to review your current AI data practices against what a modernized privacy regime will require — the direction of travel is clear even if the timeline is not.
There is no "Canadian AI Act" in force. Any compliance framework being sold under that name refers to a bill that died in January 2025. The active regulatory pressure on Canadian AI practices today comes from PIPEDA enforcement by the Office of the Privacy Commissioner, not from AI-specific legislation. That is the distinction worth building your compliance posture around.
Sources: Artificial Intelligence and Data Act (AIDA) — what was proposed, risk-based framework, scope; bill died when Parliament prorogued January 2025: ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document | Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems — ISED Canada (official), September 2023, six commitment areas, voluntary sign-on available: ised-isde.canada.ca/site/ised/en/voluntary-code-conduct-responsible-development-and-management-advanced-generative-ai-systems | Office of the Privacy Commissioner of Canada — Privacy and AI guidance, PIPEDA enforcement priorities for businesses using AI tools: priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/ | OPC Annual Report 2025-2026 "Championing privacy in the age of AI" — AI enforcement priority stated, major investigations completed under PIPEDA: priv.gc.ca/en/opc-actions-and-decisions/ar_index/202526/ar_202526/ | Working for Workers Four Act, 2024 — Ontario, AI hiring disclosure for employers with 25 or more employees posting publicly advertised positions, in force January 1, 2026: ontario.ca/laws/statute/24w13 | EU AI Act (Regulation (EU) 2024/1689) — entered into force August 1, 2024; high-risk AI system requirements active August 2, 2026; extraterritorial scope: artificialintelligenceact.eu | Bill C-36 (Protecting Privacy and Consumer Data Act) — tabled June 15, 2026, first reading; would replace PIPEDA; PIPEDA remains in force until Royal Assent: dlapiper.com/en/insights/publications/2026/06/canada-tables-bill-c36-the-protecting-privacy-and-consumer-data-act
Frequently asked
Does Canada have an AI law I need to comply with?
Not yet. The Artificial Intelligence and Data Act (AIDA), which would have been Canada's first AI-specific law, died when Parliament prorogued in January 2025 and was not revived. No federal AI-specific legislation is in force as of September 2026. The legal requirements that apply to AI use today come from privacy law (PIPEDA), sector-specific regulations, human rights legislation, and — for Ontario employers with 25 or more employees — the hiring disclosure rule under the Working for Workers Four Act.
What does PIPEDA require if I am using an AI tool that handles customer data?
PIPEDA requires meaningful and specific consent before collecting or using personal information in an AI context, including data processed by third-party tools. You need a plain-language privacy policy that explains AI data practices. You must provide working access, correction, and deletion mechanisms for individuals. The Office of the Privacy Commissioner has investigated major AI companies for violations in all of these categories and has named AI enforcement a priority for 2025-2026.
I have a team of 30 and we post jobs on job boards — does the Ontario AI disclosure rule apply?
Yes. The Ontario Working for Workers Four Act requires employers with 25 or more employees to include a disclosure in any publicly advertised job posting if AI is used to screen, assess, or select applicants. The rule has been in force since January 1, 2026. Confirm the specific wording requirement with an employment lawyer or human resources professional for your situation.
Get the weekly Signal
The AI, funding, government, and tech moves that matter for Northwestern Ontario — one email a week, source-linked, read by a human before it reaches you.
One email a week from Thunder Bay AI. Unsubscribe anytime.